Microsoft Patches Windows Zero-Day Tied to Lazarus Attacks

A Heavy Patch Load With an Active Threat Attached

Microsoft's August Patch Tuesday release landed with an unusually large payload, addressing 421 vulnerabilities across its product line, including one Windows zero-day already being exploited in the wild 1. A separate accounting from csoonline.com puts the core Microsoft fix count at 398, with the actively exploited flaw residing in the Windows Sockets (WinSock) driver — a component attackers can abuse to escalate privileges to full system control 2. Regardless of the exact tally, the message from researchers is consistent: the zero-day allows an attacker who has already gained a foothold on a machine to seize system-level privileges, making it a priority fix for enterprises and consumers alike 12.

Nation-State Fingerprints on the Exploit

What elevates this month's disclosure beyond routine patching is the attribution tied to the exploited bug. Multiple reports link the flaw to North Korean state-sponsored hacking activity, with the Lazarus Group named as the operator using the vulnerability to deploy malicious tooling 5. Described as a use-after-free flaw, the bug reportedly gave attackers full control over compromised systems and was used to install the ForestTiger backdoor 8. The combination of a memory-safety weakness and a sophisticated, well-resourced threat actor underscores why security teams are being urged to patch immediately rather than wait for a standard maintenance window 158.

Defender Bypass Adds to the Pressure

Compounding concerns around Microsoft's ecosystem, researchers have published a proof-of-concept called ShieldBreak, which claims to bypass a patch for a separate Microsoft Defender vulnerability, tracked as CVE-2026-50656, to achieve SYSTEM-level access. The PoC was reportedly validated against Windows 11 25H2 and Windows Server 2025, raising questions about whether Microsoft's initial remediation fully closed the hole 3.

The Broader Patch Tuesday Ecosystem

Microsoft was not alone on the vulnerability stage this month. SAP issued 29 patches, including a maximum-severity fix for its Commerce Cloud platform, illustrating that critical exposure isn't confined to operating systems but extends deep into enterprise business software 2.

Zero-Days Beyond Windows

The same window saw zero-day activity hit network and data infrastructure. Cisco disclosed and patched a zero-day in its Secure Firewall ASA and FTD products, tracked as CVE-2026-20349, which can be exploited remotely without authentication to trigger denial-of-service conditions; separate coverage also connects Cisco firewall exploitation to malware delivery campaigns 47. Meanwhile, a critical zero-day in Metabase, a widely used business intelligence and data visualization tool, was disclosed around August 8, 2026, allowing attackers to execute SQL injection attacks granting direct, instant access to underlying databases — potentially exposing credentials, API keys, and other sensitive organizational data 69.

Why It Matters

Taken together, this wave of disclosures — spanning Windows, Defender, Cisco firewalls, SAP, and Metabase — reflects a threat landscape where nation-state actors, malware operators, and opportunistic exploiters are converging on both infrastructure and data-layer software. For defenders, the overlapping timing of these fixes reinforces a familiar but urgent lesson: patch quickly, verify bypass claims, and assume zero-day exploitation is no longer an edge case but a recurring monthly reality.